Downloading a model is an act of trust, and it is worth being precise about what you are trusting. Not the weights — those you can inspect, hash, and run in a sandbox. What you are trusting is the description: that the licence permits what you are about to do, and that whatever the model learned from is something you would be comfortable having learned from.
We measured how much of that description actually exists. Not on a random sample of the two million repositories on the Hugging Face Hub, most of which nobody has ever pulled, but on the 1,000 most-downloaded models — the ones that end up inside real products.
The model card is not the problem
The first result was the one we did not expect. 99% of those 1,000 models ship a model card. Whatever is going wrong here, it is not that people skip the documentation step.
The gap is in what the card answers. We looked for four things a downstream user needs, each recorded in a structured, machine-readable field:
| What you would want to know | Declared in the card |
|---|---|
| A model card exists at all | 99.0% |
| A licence | 81.3% |
| What it was derived from (base model) | 35.7% |
| What it was trained on (dataset) | 20.5% |
| All four of the above | 4.2% |
Four point two per cent. One model in twenty-four carries a complete machine-readable provenance record. The rest state what they are but go quiet about where they came from.
The training-data number needs an honest caveat
That 20.5% counts the structured datasets field. A model card can perfectly well describe its training data in a paragraph of prose and leave the field empty, and reporting only the field would overstate the problem — so we measured the prose too.
We took a random subsample of 150 models, kept the ones with no structured dataset field, fetched their README files and looked for a description of training data in the text. 45% of them had one (95% confidence interval 35.9–54.3%, n=109).
Folding that back in: about 56% of the most-downloaded models disclose their training data somewhere, in a field or in prose (confidence interval 49–64%). Which leaves roughly four in ten saying nothing about it anywhere at all.
That is the honest headline, and it is less dramatic than the raw 20.5% would have been. It is also the number we would want someone to quote back at us.
Why the distinction between a field and a paragraph matters
If you are one person evaluating one model, prose is fine. You read the card, you make a judgement, you move on. The structured field buys you nothing.
It starts to matter the moment the question is asked at scale, which is the situation most organisations are drifting into. Which of the 40 models in our stack have a training-data disclosure? is a question you can answer in a second if the field is populated and cannot answer at all otherwise, short of having someone read 40 documents and form an opinion. Every compliance regime that has arrived in the last two years — the EU AI Act's transparency obligations most explicitly — assumes the answer is retrievable. In four cases out of five it is not, and in roughly four out of ten it does not exist in any form.
We have written before about what a tool listing cannot tell you about AI risk and whether a directory can place you in an AI Act risk tier. This is the same problem one layer down. A governance process assumes the metadata is present, and frequently it is not.
Three real examples, and none of them is a hobbyist
The easy assumption is that missing provenance is an amateur problem — abandoned uploads and weekend fine-tunes. The most-downloaded list does not support that.
openai/clip-vit-base-patch32 declares no licence or dataset in its card metadata. Its README describes the training data in prose — "trained on publicly available image-caption data" gathered by crawling — which serves a human reader but not an automated check.
meta-llama/Llama-3.1-8B-Instruct declares a licence (llama3.1, a bespoke one, not an OSI-approved licence you can look up) and no dataset field. It is also gated: you cannot read the card without authenticating, which means an automated provenance check does not get a "no", it gets a 401.
sentence-transformers/all-MiniLM-L6-v2 — the single most-downloaded model on the Hub — does it properly: Apache 2.0, a declared base model, and twenty-one named training datasets. It costs nothing that the others could not also afford.
The licence field has a quieter failure
81.3% declare a licence, which sounds tolerable until you look at what is in the field. A further 9.9% fill it with other, unknown, or none — a value that occupies the slot while answering nothing. 8.8% leave it empty.
So the useful figure is not "one in five has no licence". It is that one in five gives you no usable licence answer, and half of those look answered until you read them. An automated inventory that counts populated fields will score the other group as compliant.
Weighting by actual downloads rather than by repository improves things — 87.8% of downloads go to a model with a real licence, and 33.5% to one with a declared dataset. Popular models are better documented, which is not the same as being well documented.
What to actually do about it
This is not an argument for avoiding the Hub. It is an argument for one habit: check the provenance before you adopt, not after. Changing your mind later is expensive.
- Read the licence field, then read the licence. A populated field is not a permissive licence.
othermeans someone has to open the file. - If there is no dataset declaration in the metadata, read the card before you assume there is nothing. Our measurement says there is a 45% chance the prose has it.
- Treat a gated model as unmeasured, not as compliant. An authentication wall is not a disclosure.
- Record what you found at adoption time. Cards get edited. The version you evaluated is not necessarily the version that is there in six months.
What this measurement does not show
We checked three limits on this analysis rather than hoping past them.
Ranking by downloads is a choice. It weights the finding towards what people actually pull, which is what we wanted, but download counts include automated traffic: 16 of the 1,000 are test fixtures that continuous-integration systems fetch on a loop. Removing them moves the headline figures by 0.3 percentage points, which does not change the conclusion.
Gated repositories return 401 to an unauthenticated fetch. Our prose check skips those rather than scoring them as undisclosed; all 11 fetch failures in the subsample were gating. Had we counted them as silence, the "four in ten" figure would have been higher and wrong.
And a keyword search for training-data prose is a generous test, not a strict one. It finds a mention. It does not judge whether the mention is specific enough to be useful, and phrases like "trained on a large corpus of internet text" would pass it. The true disclosure rate, measured for usefulness rather than presence, is somewhere below 56%.
The measurement script is in our repository and re-runnable. The Hub moves; the numbers here are from 19 August 2026.
View author profile → · Editorial policy
